@bsb/config-vault 0.0.1

package/lib/plugins/service-config-vault/http-server.js

@@ -0,0 +1,272 @@
+import { createServer } from 'node:http';
+import { createApp, defineEventHandler, deleteCookie, getCookie, getHeader, getMethod, getQuery, readBody, sendRedirect, setCookie, setResponseStatus, toNodeListener, } from 'h3';
+export class VaultHttpServer {
+    options;
+    server;
+    constructor(options) {
+        this.options = options;
+    }
+    async start() {
+        const app = createApp();
+        app.use('/health', defineEventHandler(() => ({ status: 'ok' })));
+        app.use('/runtime/config', defineEventHandler(async (event) => {
+            const keyId = getHeader(event, 'x-vault-key-id') ?? '';
+            const secret = getHeader(event, 'x-vault-secret') ?? '';
+            const resolved = await this.options.vault.resolveRuntimeConfig(keyId, secret, this.options.obs);
+            return resolved;
+        }));
+        app.use('/setup', defineEventHandler(async (event) => {
+            if (getMethod(event) === 'GET')
+                return this.page('Vault Setup', setupForm());
+            const body = await readBody(event);
+            await this.options.vault.createFirstAdmin({
+                setupCode: String(body.setupCode ?? ''),
+                email: String(body.email ?? ''),
+                password: String(body.password ?? ''),
+                totpCode: String(body.totpCode ?? ''),
+                passkeyCredential: parseJsonObject(body.passkeyCredential),
+            });
+            return sendRedirect(event, '/login');
+        }));
+        app.use('/login', defineEventHandler(async (event) => {
+            if (getMethod(event) === 'GET')
+                return this.page('Vault Login', loginForm());
+            const body = await readBody(event);
+            const session = await this.options.vault.login(String(body.email ?? ''), String(body.password ?? ''), String(body.totpCode ?? ''), parseJsonObject(body.passkeyCredential));
+            setCookie(event, 'vault_session', session.sessionId, {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: this.options.production,
+                path: '/',
+            });
+            setCookie(event, 'vault_csrf', session.csrfToken, {
+                sameSite: 'lax',
+                secure: this.options.production,
+                path: '/',
+            });
+            return sendRedirect(event, '/');
+        }));
+        app.use('/logout', defineEventHandler(async (event) => {
+            const sessionId = getCookie(event, 'vault_session');
+            if (sessionId)
+                await this.options.vault.logout(sessionId);
+            deleteCookie(event, 'vault_session', { path: '/' });
+            deleteCookie(event, 'vault_csrf', { path: '/' });
+            return sendRedirect(event, '/login');
+        }));
+        app.use('/api/applications', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.createApplication(user.userId, String(body.name ?? ''), stringOrUndefined(body.description));
+        }));
+        app.use('/api/groups', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.createGroup(user.userId, String(body.applicationId ?? ''), String(body.name ?? ''));
+        }));
+        app.use('/api/profiles', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.createProfile(user.userId, String(body.groupId ?? ''), String(body.name ?? 'default'));
+        }));
+        app.use('/api/plugins', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.createPlugin(user.userId, {
+                org: String(body.org ?? '_'),
+                name: String(body.name ?? ''),
+                pluginId: String(body.pluginId ?? body.name ?? ''),
+                packageName: body.packageName === undefined ? null : String(body.packageName),
+                version: String(body.version ?? '0.0.0'),
+                kind: parseKind(body.kind),
+                source: parseSource(body.source),
+                configSchema: parseJsonObject(body.configSchema) ?? null,
+                eventSchema: parseJsonObject(body.eventSchema) ?? null,
+            });
+        }));
+        app.use('/api/drafts', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            const config = parseJsonObject(body.config);
+            if (!config)
+                throw new Error('Config must be a JSON object');
+            await this.options.vault.saveDraft(user.userId, String(body.profileId ?? ''), config);
+            return { success: true };
+        }));
+        app.use('/api/publish', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.publishDraft(user.userId, String(body.profileId ?? ''));
+        }));
+        app.use('/api/runtime-keys', defineEventHandler(async (event) => {
+            const user = await this.requireUser(event);
+            const body = await readBody(event);
+            return this.options.vault.createRuntimeKey(user.userId, {
+                name: String(body.name ?? ''),
+                applicationId: String(body.applicationId ?? ''),
+                groupId: String(body.groupId ?? ''),
+                profileId: String(body.profileId ?? ''),
+                containerName: body.containerName === undefined ? null : String(body.containerName),
+                configPluginId: String(body.configPluginId ?? 'config-vault'),
+            });
+        }));
+        app.use('/', defineEventHandler(async (event) => {
+            if (await this.options.vault.setupRequired())
+                return sendRedirect(event, '/setup');
+            const session = getCookie(event, 'vault_session');
+            if (!session)
+                return sendRedirect(event, '/login');
+            await this.options.vault.requireSession(session);
+            const query = getQuery(event);
+            const dashboard = await this.options.vault.dashboard();
+            return this.page('Vault', dashboardPage(dashboard, String(query.secret ?? '')));
+        }));
+        app.use(defineEventHandler((event) => {
+            setResponseStatus(event, 404);
+            return this.page('Not Found', '<p>Not found.</p>');
+        }));
+        this.server = createServer(toNodeListener(app));
+        await new Promise((resolve) => {
+            this.server?.listen(this.options.port, this.options.host, resolve);
+        });
+    }
+    async stop() {
+        await new Promise((resolve, reject) => {
+            if (!this.server) {
+                resolve();
+                return;
+            }
+            this.server.close((error) => error ? reject(error) : resolve());
+        });
+    }
+    async requireUser(event) {
+        const session = await this.options.vault.requireSession(getCookie(event, 'vault_session'));
+        const headerCsrf = getHeader(event, 'x-csrf-token');
+        const cookieCsrf = getCookie(event, 'vault_csrf');
+        if (headerCsrf !== session.csrfToken && cookieCsrf !== session.csrfToken) {
+            throw new Error('Invalid CSRF token');
+        }
+        return session;
+    }
+    page(title, body) {
+        return html(title, body);
+    }
+}
+function html(title, body) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>${escapeHtml(title)}</title>
+  <style>
+    body{font-family:system-ui,-apple-system,Segoe UI,sans-serif;margin:0;background:#f7f8fa;color:#15181c}
+    header{background:#15181c;color:#fff;padding:16px 24px;display:flex;justify-content:space-between;align-items:center}
+    main{max-width:1180px;margin:0 auto;padding:24px}
+    section{background:#fff;border:1px solid #d9dde3;border-radius:8px;padding:16px;margin:0 0 16px}
+    input,textarea,select{display:block;width:100%;box-sizing:border-box;margin:6px 0 12px;padding:9px;border:1px solid #b9c0ca;border-radius:6px;font:inherit}
+    textarea{min-height:140px;font-family:ui-monospace,Consolas,monospace}
+    button{background:#1267d8;color:#fff;border:0;border-radius:6px;padding:9px 12px;font:inherit;cursor:pointer}
+    table{width:100%;border-collapse:collapse}td,th{border-bottom:1px solid #e3e6eb;text-align:left;padding:8px}
+    .grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:16px}
+    .muted{color:#5b6470}.danger{color:#a40000}
+  </style>
+</head>
+<body>
+  <header><strong>Vault</strong><a href="/logout" style="color:#fff">Logout</a></header>
+  <main>${body}</main>
+</body>
+</html>`;
+}
+function setupForm() {
+    return `<section><h1>First Admin Setup</h1>
+    <p class="muted">Enter the one-time setup code printed in the service logs. Initial TOTP accepts <code>000000</code>; replace it after setup.</p>
+    <form method="post">
+      <input name="setupCode" placeholder="Setup code" required>
+      <input name="email" type="email" placeholder="Admin email" required>
+      <input name="password" type="password" placeholder="Password, 12+ chars" required>
+      <input name="totpCode" placeholder="TOTP code" required>
+      <textarea name="passkeyCredential" placeholder='Optional passkey JSON, e.g. {"id":"admin-device-1"}'></textarea>
+      <button>Create Admin</button>
+    </form>
+  </section>`;
+}
+function loginForm() {
+    return `<section><h1>Login</h1>
+    <form method="post">
+      <input name="email" type="email" placeholder="Email" required>
+      <input name="password" type="password" placeholder="Password" required>
+      <input name="totpCode" placeholder="TOTP code" required>
+      <textarea name="passkeyCredential" placeholder='Passkey JSON, e.g. {"id":"admin-device-1"}'></textarea>
+      <button>Login</button>
+    </form>
+  </section>`;
+}
+function dashboardPage(data, secret) {
+    return `<div class="grid">
+    <section><h2>Applications</h2>${table(data.applications.map((x) => [x.name, x.description ?? '', x.id]))}
+      <h3>Create Application</h3>${apiForm('/api/applications', ['name', 'description'])}</section>
+    <section><h2>Plugin Catalog</h2>${table(data.plugins.map((x) => [x.pluginId, x.version, x.kind, x.source]))}
+      <h3>Create/Upload Plugin</h3>${pluginForm()}</section>
+  </div>
+  <section><h2>Profiles and Runtime</h2>
+    <p class="muted">Use the JSON API to create groups/profiles, save drafts, publish, and create runtime keys. CSRF token is available in the <code>vault_csrf</code> cookie.</p>
+    ${secret ? `<p><strong>Runtime secret, shown once:</strong> <code>${escapeHtml(secret)}</code></p>` : ''}
+    <h3>Runtime Keys</h3>${table(data.runtimeKeys.map((x) => [x.name, x.id, x.profileId, x.containerName ?? '', x.revokedAt ?? 'active']))}
+  </section>
+  <section><h2>Draft Config JSON</h2>${apiForm('/api/drafts', ['profileId'], 'config')}</section>
+  <section><h2>Publish Draft</h2>${apiForm('/api/publish', ['profileId'])}</section>
+  <section><h2>Create Runtime Key</h2>${apiForm('/api/runtime-keys', ['name', 'applicationId', 'groupId', 'profileId', 'containerName', 'configPluginId'])}</section>`;
+}
+function apiForm(action, fields, textarea) {
+    return `<form data-api="${action}" onsubmit="return submitJson(this)">
+    ${fields.map((field) => `<input name="${field}" placeholder="${field}" ${field === 'configPluginId' ? 'value="config-vault"' : ''}>`).join('')}
+    ${textarea ? `<textarea name="${textarea}" placeholder="${textarea} JSON"></textarea>` : ''}
+    <button>Submit</button>
+  </form>
+  <script>
+  async function submitJson(form){
+    const data={}; for(const item of new FormData(form).entries()){data[item[0]]=item[1]}
+    const csrf=document.cookie.split('; ').find(x=>x.startsWith('vault_csrf='))?.split('=')[1]||'';
+    const res=await fetch(form.dataset.api,{method:'POST',headers:{'content-type':'application/json','x-csrf-token':csrf},body:JSON.stringify(data)});
+    alert(JSON.stringify(await res.json(),null,2)); location.reload(); return false;
+  }
+  </script>`;
+}
+function pluginForm() {
+    return apiForm('/api/plugins', ['org', 'name', 'pluginId', 'packageName', 'version', 'kind', 'source'], 'configSchema');
+}
+function table(rows) {
+    if (rows.length === 0)
+        return '<p class="muted">None</p>';
+    return `<table>${rows.map((row) => `<tr>${row.map((cell) => `<td>${escapeHtml(cell)}</td>`).join('')}</tr>`).join('')}</table>`;
+}
+function parseJsonObject(value) {
+    if (typeof value === 'object' && value !== null && !Array.isArray(value))
+        return value;
+    if (typeof value !== 'string' || value.trim() === '')
+        return undefined;
+    const parsed = JSON.parse(value);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        throw new Error('Expected JSON object');
+    return parsed;
+}
+function parseKind(value) {
+    return value === 'events' || value === 'observable' || value === 'config' ? value : 'service';
+}
+function parseSource(value) {
+    return value === 'registry' || value === 'upload' ? value : 'manual';
+}
+function stringOrUndefined(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (char) => ({
+        '&': '&amp;',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+    }[char] ?? char));
+}
+//# sourceMappingURL=http-server.js.map

package/lib/plugins/service-config-vault/http-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../../src/plugins/service-config-vault/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,SAAS,EAET,iBAAiB,EACjB,cAAc,GACf,MAAM,IAAI,CAAC;AAcZ,MAAM,OAAO,eAAe;IACT,OAAO,CAAmB;IACnC,MAAM,CAAU;IAExB,YAAY,OAAyB;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QAExB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChG,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBACxC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACrC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACrC,iBAAiB,EAAE,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC;aAC3D,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAC3B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAC3B,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CACxC,CAAC;YACF,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE;gBACnD,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBAC/B,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE;gBAChD,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBAC/B,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACpD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACpD,IAAI,SAAS;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC;QACnH,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE;gBAClD,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC;gBAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBAClD,WAAW,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC7E,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;gBACxC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI;gBACxD,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAmC,CAAC;YAC9E,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE;gBACtD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;gBAC/C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;gBACvC,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;gBACnF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9C,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE;gBAAE,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAAsC;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,OAAO,CAAC,SAAS,IAAI,UAAU,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,IAAI,CAAC,KAAa,EAAE,IAAY;QACtC,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAY;IACvC,OAAO;;;;;WAKE,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;UAgBlB,IAAI;;QAEN,CAAC;AACT,CAAC;AAED,SAAS,SAAS;IAChB,OAAO;;;;;;;;;;aAUI,CAAC;AACd,CAAC;AAED,SAAS,SAAS;IAChB,OAAO;;;;;;;;aAQI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAoD,EAAE,MAAc;IACzF,OAAO;oCAC2B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;mCACzE,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;sCAClD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;qCAC1E,UAAU,EAAE;;;;MAI3C,MAAM,CAAC,CAAC,CAAC,yDAAyD,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;2BACjF,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC;;uCAEnG,OAAO,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;mCACnD,OAAO,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,CAAC;wCACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,YAAY,CAAC;AACvK,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,MAAgB,EAAE,QAAiB;IAClE,OAAO,mBAAmB,MAAM;MAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,KAAK,kBAAkB,KAAK,KAAK,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;MAC5I,QAAQ,CAAC,CAAC,CAAC,mBAAmB,QAAQ,kBAAkB,QAAQ,oBAAoB,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;YAUnF,CAAC;AACb,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;AAC1H,CAAC;AAED,SAAS,KAAK,CAAC,IAAgB;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC1D,OAAO,UAAU,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC;AAClI,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAgC,CAAC;IAClH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACpH,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,OAAO;KACb,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/lib/plugins/service-config-vault/index.d.ts

@@ -0,0 +1,82 @@
+import * as av from 'anyvali';
+import { BSBService, type BSBServiceConstructor, type Observable } from '@bsb/base';
+export declare const VaultServiceConfigSchema: av.ObjectSchema<{
+    host: av.StringSchema;
+    port: av.Int32Schema;
+    publicUrl: av.StringSchema;
+    production: av.BoolSchema;
+    databaseUrl: av.StringSchema;
+    masterKey: av.StringSchema;
+}>;
+export type VaultServiceConfig = av.Infer<typeof VaultServiceConfigSchema>;
+export declare const EventSchemas: {
+    readonly onReturnableEvents: {
+        readonly 'vault.runtime.resolve': {
+            input: av.ObjectSchema<{
+                keyId: av.StringSchema;
+                secret: av.StringSchema;
+            }>;
+            output: av.ObjectSchema<{
+                application: av.StringSchema;
+                group: av.StringSchema;
+                profile: av.StringSchema;
+                version: import("@bsb/base").BSBType;
+                config: av.UnknownSchema;
+            }>;
+            description?: string;
+            defaultTimeout?: number;
+            readonly __brand: "returnable";
+        };
+    };
+};
+export declare const Config: import("@bsb/base").BSBPluginConfigClass<av.ObjectSchema<{
+    host: av.StringSchema;
+    port: av.Int32Schema;
+    publicUrl: av.StringSchema;
+    production: av.BoolSchema;
+    databaseUrl: av.StringSchema;
+    masterKey: av.StringSchema;
+}>>;
+export declare class Plugin extends BSBService<InstanceType<typeof Config>, typeof EventSchemas> {
+    static Config: import("@bsb/base").BSBPluginConfigClass<av.ObjectSchema<{
+        host: av.StringSchema;
+        port: av.Int32Schema;
+        publicUrl: av.StringSchema;
+        production: av.BoolSchema;
+        databaseUrl: av.StringSchema;
+        masterKey: av.StringSchema;
+    }>>;
+    static EventSchemas: {
+        readonly onReturnableEvents: {
+            readonly 'vault.runtime.resolve': {
+                input: av.ObjectSchema<{
+                    keyId: av.StringSchema;
+                    secret: av.StringSchema;
+                }>;
+                output: av.ObjectSchema<{
+                    application: av.StringSchema;
+                    group: av.StringSchema;
+                    profile: av.StringSchema;
+                    version: import("@bsb/base").BSBType;
+                    config: av.UnknownSchema;
+                }>;
+                description?: string;
+                defaultTimeout?: number;
+                readonly __brand: "returnable";
+            };
+        };
+    };
+    readonly initBeforePlugins?: string[] | undefined;
+    readonly initAfterPlugins?: string[] | undefined;
+    readonly runBeforePlugins?: string[] | undefined;
+    readonly runAfterPlugins?: string[] | undefined;
+    private readonly setupCode;
+    private readonly store;
+    private readonly vault;
+    private httpServer?;
+    constructor(config: BSBServiceConstructor<InstanceType<typeof Config>, typeof EventSchemas>);
+    init(obs: Observable): Promise<void>;
+    run(obs: Observable): Promise<void>;
+    dispose(): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/plugins/service-config-vault/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-config-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EAKhB,MAAM,WAAW,CAAC;AAMnB,eAAO,MAAM,wBAAwB;;;;;;;EAOK,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAU3E,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;CAWvB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;GASlB,CAAC;AAEF,qBAAa,MAAO,SAAQ,UAAU,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IACtF,MAAM,CAAC,MAAM;;;;;;;QAAU;IACvB,MAAM,CAAC,YAAY;;;;;;;;;;;;;;;;;;;MAAgB;IAEnC,SAAgB,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACzD,SAAgB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxD,SAAgB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxD,SAAgB,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAEvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,UAAU,CAAC,CAAkB;gBAEzB,MAAM,EAAE,qBAAqB,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IAerF,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASnC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAI/B"}

package/lib/plugins/service-config-vault/index.js

@@ -0,0 +1,95 @@
+import * as av from 'anyvali';
+import { BSBService, bsb, createConfigSchema, createEventSchemas, createReturnableEvent, } from '@bsb/base';
+import { loadMasterKey, newToken } from './crypto.js';
+import { VaultHttpServer } from './http-server.js';
+import { VaultStore } from './store.js';
+import { VaultService } from './vault.js';
+export const VaultServiceConfigSchema = av.object({
+    host: av.string().default('0.0.0.0').describe('HTTP bind host'),
+    port: av.int32().min(1).max(65535).default(8080).describe('HTTP port for Vault admin UI and API'),
+    publicUrl: av.string().default('http://localhost:8080').describe('External URL used for admin and passkey flows'),
+    production: av.bool().default(false).describe('Enable production cookie/security checks'),
+    databaseUrl: av.string().minLength(1).describe('Postgres connection string'),
+    masterKey: av.string().minLength(1).describe('Base64 encoded 32-byte Vault master key'),
+}).describe('Vault service configuration');
+const RuntimeConfigResponse = bsb.object({
+    application: bsb.string({ description: 'Bound application name' }),
+    group: bsb.string({ description: 'Bound service group name' }),
+    profile: bsb.string({ description: 'Bound deployment profile name' }),
+    version: bsb.int32({ min: 1, description: 'Active config version' }),
+    config: bsb.unknown('Resolved BSB runtime config object'),
+}, 'Resolved runtime config response');
+export const EventSchemas = createEventSchemas({
+    onReturnableEvents: {
+        'vault.runtime.resolve': createReturnableEvent(bsb.object({
+            keyId: bsb.string({ min: 1, description: 'Vault runtime API key id' }),
+            secret: bsb.string({ min: 1, description: 'Vault runtime API secret' }),
+        }, 'Vault runtime config resolve request'), RuntimeConfigResponse, 'Resolve latest active BSB config for a runtime API key'),
+    },
+});
+export const Config = createConfigSchema({
+    name: 'Vault',
+    description: 'Secure BSB managed configuration service with Postgres, admin UI, plugin catalog, and runtime API keys',
+    image: '../../../docs/public/assets/images/bsb-logo.png',
+    tags: ['vault', 'config', 'security', 'postgres', 'h3', 'admin-ui'],
+    documentation: ['./docs/service-config-vault.md'],
+}, VaultServiceConfigSchema);
+export class Plugin extends BSBService {
+    static Config = Config;
+    static EventSchemas = EventSchemas;
+    initBeforePlugins;
+    initAfterPlugins;
+    runBeforePlugins;
+    runAfterPlugins;
+    setupCode;
+    store;
+    vault;
+    httpServer;
+    constructor(config) {
+        super({
+            ...config,
+            eventSchemas: EventSchemas,
+        });
+        this.setupCode = newToken(18);
+        this.store = new VaultStore(this.config.databaseUrl);
+        this.vault = new VaultService({
+            store: this.store,
+            masterKey: loadMasterKey(this.config.masterKey),
+            setupCode: this.setupCode,
+        });
+    }
+    async init(obs) {
+        obs.log.info('Initializing Vault service');
+        await this.store.init();
+        if (await this.vault.setupRequired()) {
+            obs.log.warn('Vault first admin setup required. Setup code: {setupCode}', {
+                setupCode: this.setupCode,
+            });
+        }
+        await this.events.onReturnableEvent('vault.runtime.resolve', obs, async (eventObs, payload) => {
+            return this.vault.resolveRuntimeConfig(payload.keyId, payload.secret, eventObs);
+        });
+        this.httpServer = new VaultHttpServer({
+            host: this.config.host,
+            port: this.config.port,
+            publicUrl: this.config.publicUrl,
+            production: this.config.production,
+            obs,
+            vault: this.vault,
+        });
+    }
+    async run(obs) {
+        if (!this.httpServer)
+            throw new Error('Vault HTTP server was not initialized');
+        await this.httpServer.start();
+        obs.log.info('Vault admin UI/API started on {host}:{port}', {
+            host: this.config.host,
+            port: this.config.port,
+        });
+    }
+    async dispose() {
+        await this.httpServer?.stop();
+        await this.store.close();
+    }
+}
+//# sourceMappingURL=index.js.map

package/lib/plugins/service-config-vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/service-config-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,UAAU,EAGV,GAAG,EACH,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC/D,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACjG,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IACjH,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACzF,WAAW,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC5E,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;CACxF,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;AAI3C,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,CAAC;IACvC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IAClE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC9D,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IACrE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACpE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,oCAAoC,CAAC;CAC1D,EAAE,kCAAkC,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAC7C,kBAAkB,EAAE;QAClB,uBAAuB,EAAE,qBAAqB,CAC5C,GAAG,CAAC,MAAM,CAAC;YACT,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;YACtE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;SACxE,EAAE,sCAAsC,CAAC,EAC1C,qBAAqB,EACrB,wDAAwD,CACzD;KACF;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,kBAAkB,CACtC;IACE,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,wGAAwG;IACrH,KAAK,EAAE,iDAAiD;IACxD,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC;IACnE,aAAa,EAAE,CAAC,gCAAgC,CAAC;CAClD,EACD,wBAAwB,CACzB,CAAC;AAEF,MAAM,OAAO,MAAO,SAAQ,UAA4D;IACtF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAEnB,iBAAiB,CAAwB;IACzC,gBAAgB,CAAwB;IACxC,gBAAgB,CAAwB;IACxC,eAAe,CAAwB;IAEtC,SAAS,CAAS;IAClB,KAAK,CAAa;IAClB,KAAK,CAAe;IAC7B,UAAU,CAAmB;IAErC,YAAY,MAA+E;QACzF,KAAK,CAAC;YACJ,GAAG,MAAM;YACT,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE;gBACxE,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC5F,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,eAAe,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAe;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,EAAE;YAC1D,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC"}

package/lib/plugins/service-config-vault/passkeys.d.ts

@@ -0,0 +1,9 @@
+export interface PasskeyVerifier {
+    verifyRegistration(credential: Record<string, unknown>): Promise<Record<string, unknown>>;
+    verifyAuthentication(credential: Record<string, unknown>, storedPublicKey: Record<string, unknown>): Promise<boolean>;
+}
+export declare class JsonPasskeyVerifier implements PasskeyVerifier {
+    verifyRegistration(credential: Record<string, unknown>): Promise<Record<string, unknown>>;
+    verifyAuthentication(credential: Record<string, unknown>, storedPublicKey: Record<string, unknown>): Promise<boolean>;
+}
+//# sourceMappingURL=passkeys.d.ts.map

package/lib/plugins/service-config-vault/passkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-config-vault/passkeys.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvH;AAED,qBAAa,mBAAoB,YAAW,eAAe;IACnD,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAOzF,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAG5H"}

package/lib/plugins/service-config-vault/passkeys.js

@@ -0,0 +1,12 @@
+export class JsonPasskeyVerifier {
+    async verifyRegistration(credential) {
+        if (typeof credential.id !== 'string' || credential.id.length < 8) {
+            throw new Error('Invalid passkey credential');
+        }
+        return credential;
+    }
+    async verifyAuthentication(credential, storedPublicKey) {
+        return typeof credential.id === 'string' && credential.id === storedPublicKey.id;
+    }
+}
+//# sourceMappingURL=passkeys.js.map

package/lib/plugins/service-config-vault/passkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.js","sourceRoot":"","sources":["../../../src/plugins/service-config-vault/passkeys.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,kBAAkB,CAAC,UAAmC;QAC1D,IAAI,OAAO,UAAU,CAAC,EAAE,KAAK,QAAQ,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAmC,EAAE,eAAwC;QACtG,OAAO,OAAO,UAAU,CAAC,EAAE,KAAK,QAAQ,IAAI,UAAU,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC;IACnF,CAAC;CACF"}

package/lib/plugins/service-config-vault/store.d.ts

@@ -0,0 +1,42 @@
+import type { ApplicationRecord, AuditRecord, ConfigDraftRecord, ConfigVersionRecord, GroupRecord, PasskeyRecord, PluginCatalogRecord, ProfileRecord, RuntimeKeyRecord, SessionRecord, UserRecord } from './types.js';
+export declare class VaultStore {
+    private readonly pool;
+    constructor(databaseUrl: string);
+    close(): Promise<void>;
+    init(): Promise<void>;
+    countAdmins(): Promise<number>;
+    createUser(user: UserRecord): Promise<void>;
+    getUserByEmail(email: string): Promise<UserRecord | null>;
+    getUser(id: string): Promise<UserRecord | null>;
+    createPasskey(passkey: PasskeyRecord): Promise<void>;
+    listPasskeys(userId: string): Promise<PasskeyRecord[]>;
+    createSession(session: SessionRecord): Promise<void>;
+    getSession(id: string): Promise<SessionRecord | null>;
+    deleteSession(id: string): Promise<void>;
+    createApplication(record: ApplicationRecord): Promise<void>;
+    listApplications(): Promise<ApplicationRecord[]>;
+    createGroup(record: GroupRecord): Promise<void>;
+    listGroups(applicationId: string): Promise<GroupRecord[]>;
+    createProfile(record: ProfileRecord): Promise<void>;
+    getProfile(id: string): Promise<ProfileRecord | null>;
+    listProfiles(groupId: string): Promise<ProfileRecord[]>;
+    createPlugin(record: PluginCatalogRecord): Promise<void>;
+    listPlugins(): Promise<PluginCatalogRecord[]>;
+    upsertDraft(record: ConfigDraftRecord): Promise<void>;
+    getDraft(profileId: string): Promise<ConfigDraftRecord | null>;
+    createVersion(record: ConfigVersionRecord): Promise<void>;
+    nextVersion(profileId: string): Promise<number>;
+    getVersion(id: string): Promise<ConfigVersionRecord | null>;
+    createRuntimeKey(record: RuntimeKeyRecord): Promise<void>;
+    getRuntimeKey(id: string): Promise<RuntimeKeyRecord | null>;
+    listRuntimeKeys(profileId?: string): Promise<RuntimeKeyRecord[]>;
+    revokeRuntimeKey(id: string): Promise<void>;
+    resolveRuntimeBinding(keyId: string): Promise<{
+        key: RuntimeKeyRecord;
+        application: ApplicationRecord;
+        group: GroupRecord;
+        profile: ProfileRecord;
+    } | null>;
+    audit(record: AuditRecord): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/plugins/service-config-vault/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-config-vault/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,UAAU,EACX,MAAM,YAAY,CAAC;AAEpB,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;gBAEhB,WAAW,EAAE,MAAM;IAIzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyGrB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKzD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAK/C,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKtD,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKrD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3D,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAKhD,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAKzD,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKrD,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKvD,YAAY,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBxD,WAAW,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAK7C,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAK9D,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAK3D,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAK3D,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAOhE,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAClD,GAAG,EAAE,gBAAgB,CAAC;QACtB,WAAW,EAAE,iBAAiB,CAAC;QAC/B,KAAK,EAAE,WAAW,CAAC;QACnB,OAAO,EAAE,aAAa,CAAC;KACxB,GAAG,IAAI,CAAC;IAwBH,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhD"}